CVE-2025-20226

Summary

CVE-2025-20226 is a vulnerability affecting Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, as well as Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214. An unprivileged user, without holding "admin" or "power" roles, can execute a saved search with a risky command using the permissions of a higher-privileged user. The exploit relies on the attacker tricking the victim into making a request via their browser. SPL safeguards for risky commands on the "/services/streams/search" endpoint can be bypassed through this vulnerability. However, the authenticated user cannot exploit it at will.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.